Publish host artifacts (ocm-agent + Firecracker kernel + rootfs) to GitHub Releases

[mathaix]

Goal

Publish the host bootstrap artifacts to GitHub Releases so any operator (and public CI) can provision Firecracker hosts without access to a private GCS artifact bucket.

Why

backend/internal/provisioner/host-startup.sh already defaults its artifact source to
https://github.com/mathaix/OpenClawMachines/releases/latest/download (config.go:111,
OCM_ARTIFACT_BASE_URL). But there are no published releases, so a stock-image host
bootstrap cannot download ocm-agent or the guest kernel and never becomes healthy
(observed in the spot-e2e lane: agent.health.failed: timeout after 12m, see #10 / PR #18).

release-artifacts.yml already builds + publishes ocm-agent (+ authproxy, ocm-secrets)
on v* tags, but explicitly defers the Firecracker guest kernel (vmlinux) and the
rootfs image (TODO in the workflow header) — those are the missing pieces.

Scope

• Build + publish the Firecracker guest kernel (vmlinux) as a release asset (kernel is not currently built by this repo).
• Build + publish the rootfs / openclaw runtime image(s) (scripts/build-rootfs.sh, needs Docker; larger pipeline).
• Confirm the published agent-manifest.json + asset URLs match what host-startup.sh expects from ARTIFACT_BASE_URL.
• Cut an initial release so releases/latest/download resolves.
• Validate an operator/public-CI host can provision end-to-end from GitHub Releases only (no GCS bucket).

Related

• Public-safe CI and release lanes #4 (public-safe CI and release lanes — release-artifact scope)
• Wire Firecracker E2E tests into GitHub Actions with ephemeral GCP spot runner #10 / PR fix(spot-e2e): don't abort poll loops under set -e/pipefail #18 (spot-e2e currently uses the private gs://openclawmachines bucket as an interim source)
• Multi-provider host auto-provisioning (HostProvider abstraction) #11 (multi-provider host provisioning — same artifact-distribution dependency)

[mathaix]

Owner decision: stick with GCS for artifact distribution. GitHub Releases can't hold the rootfs (the current image is ~3.8 GB zst; the per-asset cap is 2 GB), so the GCS bucket stays the canonical artifact source and the docs will describe it as such (bucket layout, manifests, OCM_ARTIFACT_BUCKET / *_GCS_MANIFEST). GitHub-Releases publishing for the small binaries (ocm-agent, authproxy, ocm-secrets) can remain a follow-up if public no-auth pulls are wanted later.

🤖 Generated with Claude Code